{"id":"CVE-2022-23614","aliases":["DEBIAN-CVE-2022-23614","DSA-5107-1","EUVD-2022-0842","GHSA-5mv2-rx3q-4w2v","UBUNTU-CVE-2022-23614","USN-5947-1"],"status":"published","title":"Code injection in Twig","description":"Twig is an open source template language for PHP. When in a sandbox mode, the `arrow` parameter of the `sort` filter must be a closure to avoid attackers being able to run arbitrary PHP functions. In affected versions this constraint was not properly enforced and could lead to code injection of arbitrary PHP code. Patched versions now disallow calling non Closure in the `sort` filter as is the case for some other filters. Users are advised to upgrade.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.08209,"percentile":0.94919,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-74","CWE-94"],"published":"2022-02-04T22:25:11Z","modified":"2026-11-03T06:02:12Z","exploits":[{"source":"pocgithub","id":"davwwwx/CVE-2022-23614","title":"davwwwx/CVE-2022-23614","date":"2022-07-18","url":"https://github.com/davwwwx/CVE-2022-23614"},{"source":"pocgithub","id":"4rtamis/CVE-2022-23614","title":"4rtamis/CVE-2022-23614","date":"2023-07-04","url":"https://github.com/4rtamis/CVE-2022-23614"}],"fixes":[{"ecosystem":"Packagist","package":"twig/twig","fixed_in":["2.14.11","3.3.8"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"php-twig","fixed_in":["3.3.8-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"php-twig","fixed_in":["3.3.8-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"php-twig","fixed_in":["3.3.8-1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"php-twig","fixed_in":["2.14.3-1+deb11u1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"php-twig","fixed_in":["2.12.5-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"twig/twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.14.11"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"twig/twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.3.8"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"php-twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.8-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"php-twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.8-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"php-twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.8-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"php-twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.3-1+deb11u1"}]}],"versions":["2.14.3-1"]},{"source":"osv","ecosystem":"Packagist","package":"twig/twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.14.11"}]}],"versions":["v2.0.0","v2.1.0","v2.10.0","v2.11.0","v2.11.1","v2.11.2","v2.11.3","v2.12.0","v2.12.1","v2.12.2","v2.12.3","v2.12.4","v2.12.5","v2.13.0","v2.13.1","v2.14.0","v2.14.1","v2.14.10","v2.14.2","v2.14.3","v2.14.4","v2.14.5","v2.14.6","v2.14.7","v2.14.8","v2.14.9","v2.2.0","v2.3.0","v2.3.1","v2.3.2","v2.4.0","v2.4.1","v2.4.2","v2.4.3","v2.4.4","v2.4.5","v2.4.6","v2.4.7","v2.4.8","v2.5.0","v2.6.0","v2.6.1","v2.6.2","v2.7.0","v2.7.1","v2.7.2","v2.7.3","v2.7.4","v2.8.0","v2.8.1","v2.9.0"]},{"source":"osv","ecosystem":"Packagist","package":"twig/twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.3.8"}]}],"versions":["v3.0.0","v3.0.1","v3.0.2","v3.0.3","v3.0.4","v3.0.5","v3.1.0","v3.1.1","v3.2.1","v3.3.0","v3.3.1","v3.3.2","v3.3.3","v3.3.4","v3.3.5","v3.3.6","v3.3.7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"php-twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.5-1ubuntu0.1~esm1"}]}],"versions":["2.11.3-2","2.12.1-1","2.12.2-1","2.12.3-1","2.12.5-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.1-1ubuntu4+esm1"}]}],"versions":["1.20.0-1","1.23.1-1ubuntu1","1.23.1-1ubuntu4"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6-1ubuntu0.1~esm1"}]}],"versions":["1.24.0-2ubuntu1","2.4.4-2ubuntu1","2.4.6-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"php-twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.5-1ubuntu0.1~esm1"}]}],"versions":["2.11.3-2","2.12.1-1","2.12.2-1","2.12.3-1","2.12.5-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"php-twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.8-2ubuntu4+esm1"}]}],"versions":["3.3.2-1ubuntu3","3.3.4-1","3.3.6-1","3.3.7-1","3.3.8-2ubuntu4"],"bundled":3}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"symfony","product":"twig"},{"vendor":"twigphp","product":"twig"}],"references":[{"url":"https://github.com/twigphp/Twig/security/advisories/GHSA-5mv2-rx3q-4w2v","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/twigphp/Twig/commit/22b9dc3c03ee66d7e21d9ed2ca76052b134cb9e9","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/twigphp/Twig/commit/2eb33080558611201b55079d07ac88f207b466d5","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OTN4273U4RHVIXED64T7DSMJ3VYTPRE7/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PECHIY2XLWUH2WLCNPDGNFMPHPRPCEDZ/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I2PVV5DUTRUECTIHMTWRI5Z7DVNYQ2YO/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SIGZCFSYLPP7UVJ4E4NLHSOQSKYNXSAD/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","advisory"]},{"url":"https://www.debian.org/security/2022/dsa-5107","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23614","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I2PVV5DUTRUECTIHMTWRI5Z7DVNYQ2YO/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OTN4273U4RHVIXED64T7DSMJ3VYTPRE7/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PECHIY2XLWUH2WLCNPDGNFMPHPRPCEDZ/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SIGZCFSYLPP7UVJ4E4NLHSOQSKYNXSAD/"},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2022-23614.yaml","tags":["web"]},{"url":"https://symfony.com/blog/twig-security-release-disallow-non-closures-in-the-sort-filter","tags":["web"]},{"url":"https://github.com/advisories/GHSA-5mv2-rx3q-4w2v"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23614.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-23614","tags":["advisory"]},{"url":"https://github.com/twigphp/Twig","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I2PVV5DUTRUECTIHMTWRI5Z7DVNYQ2YO","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OTN4273U4RHVIXED64T7DSMJ3VYTPRE7","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PECHIY2XLWUH2WLCNPDGNFMPHPRPCEDZ","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SIGZCFSYLPP7UVJ4E4NLHSOQSKYNXSAD","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-23614","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5947-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23614","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-9942","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-39261","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-23614","title":"Code injection in Twig","description":"Twig is an open source template language for PHP. When in a sandbox mode, the `arrow` parameter of the `sort` filter must be a closure to avoid attackers being able to run arbitrary PHP functions. In affected versions this constraint was not properly enforced and could lead to code injection of arbitrary PHP code. Patched versions now disallow calling non Closure in the `sort` filter as is the case for some other filters. Users are advised to upgrade.","status":"published","published":"2022-02-04T22:25:11Z","modified":"2025-04-23T19:08:27.99Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:34:29.842547Z"}],"euvd":[{"id":"EUVD-2022-0842","description":"Twig is an open source template language for PHP. When in a sandbox mode, the `arrow` parameter of the `sort` filter must be a closure to avoid attackers being able to run arbitrary PHP functions. In affected versions this constraint was not properly enforced and could lead to code injection of arbitrary PHP code. Patched versions now disallow calling non Closure in the `sort` filter as is the case for some other filters. Users are advised to upgrade.","status":"published","published":"2022-02-04T22:25:11Z","modified":"2025-04-23T19:08:27Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:06.891582Z"}],"ghsa":[{"id":"GHSA-5mv2-rx3q-4w2v","title":"Code injection in Twig","description":"# Description\n\nWhen in a sandbox mode, the `arrow` parameter of the `sort` filter must be a closure to avoid attackers being able to run arbitrary PHP functions.\n\n# Resolution\n\nWe now disallow calling non Closure in the `sort` filter like we already did for some other filters.\n\n# Credits\n\nWe would like to thank Marlon Starkloff for reporting the issue and Fabien Potencier for fixing the issue.\n ","status":"published","published":"2022-02-10T22:21:48Z","modified":"2024-02-05T11:10:49Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-74","CWE-94"],"updated_at":"2026-11-02T14:37:35.293818Z"}],"nvd":[{"id":"CVE-2022-23614","description":"Twig is an open source template language for PHP. When in a sandbox mode, the `arrow` parameter of the `sort` filter must be a closure to avoid attackers being able to run arbitrary PHP functions. In affected versions this constraint was not properly enforced and could lead to code injection of arbitrary PHP code. Patched versions now disallow calling non Closure in the `sort` filter as is the case for some other filters. Users are advised to upgrade.","status":"published","published":"2022-02-04T23:15:15.727Z","modified":"2026-06-17T04:30:29.14Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-74","CWE-94"],"updated_at":"2026-11-02T14:07:11.52734Z"}],"osv":[{"id":"CVE-2022-23614","title":"Code injection in Twig","description":"Twig is an open source template language for PHP. When in a sandbox mode, the `arrow` parameter of the `sort` filter must be a closure to avoid attackers being able to run arbitrary PHP functions. In affected versions this constraint was not properly enforced and could lead to code injection of arbitrary PHP code. Patched versions now disallow calling non Closure in the `sort` filter as is the case for some other filters. Users are advised to upgrade.","status":"published","published":"2022-02-04T22:25:11Z","modified":"2026-10-28T02:30:35.099006593Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T15:44:24.061177Z"},{"id":"GHSA-5mv2-rx3q-4w2v","title":"Code injection in Twig","description":"# Description\n\nWhen in a sandbox mode, the `arrow` parameter of the `sort` filter must be a closure to avoid attackers being able to run arbitrary PHP functions.\n\n# Resolution\n\nWe now disallow calling non Closure in the `sort` filter like we already did for some other filters.\n\n# Credits\n\nWe would like to thank Marlon Starkloff for reporting the issue and Fabien Potencier for fixing the issue.\n ","status":"published","published":"2022-02-10T22:21:48Z","modified":"2024-02-16T08:18:54.98196Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-74","CWE-94"],"updated_at":"2026-11-02T15:46:38.553953Z"},{"id":"UBUNTU-CVE-2022-23614","description":"Twig is an open source template language for PHP. When in a sandbox mode, the `arrow` parameter of the `sort` filter must be a closure to avoid attackers being able to run arbitrary PHP functions. In affected versions this constraint was not properly enforced and could lead to code injection of arbitrary PHP code. Patched versions now disallow calling non Closure in the `sort` filter as is the case for some other filters. Users are advised to upgrade.","status":"published","published":"2022-02-04T23:15:00Z","modified":"2026-02-04T02:12:49.508195Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:53:53.13624Z"},{"id":"DEBIAN-CVE-2022-23614","description":"Twig is an open source template language for PHP. When in a sandbox mode, the `arrow` parameter of the `sort` filter must be a closure to avoid attackers being able to run arbitrary PHP functions. In affected versions this constraint was not properly enforced and could lead to code injection of arbitrary PHP code. Patched versions now disallow calling non Closure in the `sort` filter as is the case for some other filters. Users are advised to upgrade.","status":"published","published":"2022-02-04T23:15:15.727Z","modified":"2026-11-03T06:02:12.997203322Z","updated_at":"2026-11-03T06:44:05.456691Z"},{"id":"DSA-5107-1","title":"php-twig - security update","status":"published","published":"2022-03-24T00:00:00Z","modified":"2026-03-09T02:09:32.558088Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"USN-5947-1","title":"php-twig, twig vulnerabilities","description":"Fabien Potencier discovered that Twig was not properly enforcing sandbox\npolicies when dealing with objects automatically cast to strings by PHP.\nAn attacker could possibly use this issue to expose sensitive information.\nThis issue was only fixed in Ubuntu 16.04 ESM and Ubuntu 18.04 ESM.\n(CVE-2019-9942)\n\nMarlon Starkloff discovered that Twig was not properly enforcing closure\nconstraints in some of its array filtering functions. An attacker could\npossibly use this issue to execute arbitrary code. This issue was only\nfixed in Ubuntu 20.04 ESM. (CVE-2022-23614)\n\nDariusz Tytko discovered that Twig was not properly verifying input data\nutilized when defining pathnames used to access files in a system. An\nattacker could possibly use this issue to access unauthorized resources\nand expose sensitive information. (CVE-2022-39261)\n","status":"published","published":"2023-03-13T10:55:33Z","modified":"2026-06-25T13:31:52.941324068Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}